Event data can exist in multiple sets. Grouping by a set column aggregates individual elements of sets across events in the query. For this reason, the sum of the events in the set elements is greater than the actual number of events.
String data is groupable by default. However, you can can also define groups by other means. In 2.x, you can also define a group using metrics, with the exception of ratio metrics. In 3.x, you can also define a group using properties.
This article shows you how to specify a 2.x Group and 3.x Split by.
Using a 2.x group
Because string data is groupable by default, columns with string data automatically appear as group options. You can create groups with other data types through the use of metrics—other than ratio metrics. This section shows you how to view a list of groupable columns in your data, as well as how to create a 2.x group for a query.
To view a list of groupable columns, do the following:
- In the Explorer window, click the Settings icon in the left navigation bar. A list of datasets appears in the window on the right.
- Click the Edit (pencil) icon for the desired dataset. A list of dataset columns appears. We chose the movies dataset.
- Select and drag a column heading (boundary) to the left to bring the Groupable column into view.
The names with a check mark are Group options. These columns are created when your data is ingested.
To create a 2.x group, do the following
- Click the Explorer icon in the left navigation bar.
- At the top of the query builder, select a Dataset and View from the drop-down menus. In our example, we chose the usage dataset and Time View.
- Specify a Start and End time. In our example, we specified a Start time of 180 days ago and an End time of now.
- Under Measure, choose an aggregation option from the drop-down list. In our example, we chose Count of Events.
- Under Compare, enter or select a Groups name or names in the text field. In our example, we chose user and movie. We received the following results for a query that counts the total events from 180 days ago till now, grouped user and movie.
This is an unsampled query, and we deselected the All others check box for the following view.
Using a 3.x split by
In 3.x, Split by provides similar functionality to that of Group in 2.x. When you Split by a property, you essentially group events that match the specified parameters. This section shows you how to create a query that uses split by with a property.
To create a 3.x split by, do the following:
- Click the Explore icon in the left navigation bar.
- At the top left of the window, select a dataset from the drop-down list. In our example, we chose movies.
- For set 1, select a function and Filtered to options from the drop-down lists, then click Set 1 and enter a meaningful name. In our example, we chose Show count of events, Filtered to all events. We named the set User Movies.
- Select a Split by option from the drop-down list. In our example, we chose to split by movie and user actors. We accepted the Limit of 25 and Ordered by Movie User descending.
- Specify a Starting and Ending time over which to scan data for the query. For Starting, we entered 180 days ago, for Ending we entered now.
- Select All for an unsampled query, then click GO. We received the following results for our query of event, split by movie and user over the last 180 days.
In the legend on the right, we selected All others to Hide this line for the following view.